All Products
Search
Document Center

Simple Log Service:Variables in alert templates (new version)

Last Updated:Apr 24, 2024

This topic describes the variables that are available for use in the new version of alert templates. This topic also describes the methods that you can use to reference the variables.

Reference methods

Important

You must reference variables by using the full names of the variables. If a referenced variable cannot be found or is invalid, Simple Log Service replaces the variable with an empty string. If the value of a referenced variable is of the object type, the value is converted to a JSON string. Make sure that the name of a variable conforms to the following rules: The name must contain letters, digits, and underscores. The name cannot start with a digit.

  • If a variable name conforms to the rules, reference the variable in the {{alert.xxx}} format.

  • If a variable name does not conform to the rules, reference the variable name in a different format. For example, if you want to reference the __tag__:__namespace__ variable, use {{alert.annotations["__tag__:__namespace__"] }}.

When you configure an action policy, you must select an alert template. The alert template specifies the content and subject of alert notifications. When you configure the Content and Subject parameters for an alert template, you can reference variables in the {{ alert.xxx }} format. Before Simple Log Service sends an alert notification, Simple Log Service replaces the variables that are referenced in the Content and Subject parameters with the actual values. For example, Simple Log Service replaces {{ alert.project }} with the name of the project to which the configured alert rule belongs.

You can also use control flows and built-in functions to manipulate and process variables. For more information about the syntax and built-in functions that are supported by the new version of alert templates, see Syntax for new alert templates and Built-in functions in alert templates.

Alert attributes

Variable

Description

Type

Value example

Reference example

aliuid

The ID of the Alibaba Cloud account to which the project belongs.

string

117918634953****

The project in which the alert is triggered belongs to the Alibaba Cloud account {{ alert.aliuid }}.

alert_instance_id

The execution ID of the alert that is triggered.

string

ee16a8f435485f3f-5be6b81edc520-3d6****

The execution ID of the alert that is triggered is {{ alert.alert_instance_id }}.

alert_id

The ID of the alert rule. Each alert rule must have a unique ID in the project to which the alert rule belongs.

string

alert-12345

The ID of the alert rule is {{ alert.alert_id }}.

alert_name

The name of the alert rule.

string

Test alert rule

The name of the alert rule based on which the alert is triggered is {{ alert.alert_name }}.

alert_type

The type of the alert.

  • sls_alert: The alert is triggered based on an alert rule in Simple Log Service.

  • sls_pub: The alert is ingested from an alerting system rather than Simple Log Service.

  • sls_ml: The alert is triggered by intelligent inspection in Simple Log Service.

string

sls_alert

The type of the alert is {{ alert.alert_type }}, which is converted to {{ alert.alert_type | format_type }}.

region

The region.

string

cn-hangzhou

The alert is triggered in the {{ alert.region }} region.

project

The project to which the alert rule belongs.

string

my-project

The alert rule based on which the alert is triggered belongs to the {{ alert.project }} project.

next_eval_interval

The length of time before the next evaluation activity starts. Unit: seconds.

int

300

The next evaluation activity starts after {{ alert.next_eval_interval }} seconds.

alert_time

The time at which the current evaluation activity starts.

int

1616744734

The current evaluation activity starts at {{ alert.alert_time }}, which is converted to {{ alert.alert_time | format_date }}.

fire_time

The time at which the alert is triggered for the first time.

int

1616059834

The alert is triggered at {{ alert.fire_time }} for the first time, which is converted to {{ alert.fire_time | format_date }}.

status

The status of the alert.

  • firing: The alert is triggered.

  • resolved: The alert is cleared.

string

firing

The status of the alert is {{ alert.status }}, which is converted to {{ alert.status | format_status }}.

resolve_time

The time at which the alert is cleared.

  • If the alert is in the firing state, the value is 0.

  • If the alert is in the resolved state, the value is the point in time at which the alert is cleared.

int

0

The alert is cleared at {{ alert.resolve_time }}, which is converted to {{ alert.resolve_time | format_date }}.

severity

The severity level of the alert.

  • 10: Critical

  • 8: High

  • 6: Medium

  • 4: Low

  • 2: Report

int

10

The severity level of the alert is {{ alert.severity }}, which is converted to {{ alert.severity | format_severity }}.

labels

The labels of the alert.

map

{"env":"test"}

The labels of the alert are {{ alert.labels | to_list }}.

annotations

The annotations of the alert.

map

{ "title": "Alert title","desc": "Alert description" }

The annotations of the alert are {{ alert.annotations | to_list }}.

results

The parameters and intermediate results that are returned. The value of this variable is an array. For more information about the value of this variable, see QueryData structure.

array

See the "Appendix" section at the end of this topic.

The first query starts at {{ alert.results[0].start_time }} and ends at {{ alert.results[0].end_time }}. The value of the count variable is {{ alert.results[0].fire_result.cnt }}. The query statement is {{ alert.results[0].query }}.

fire_results

The data records for which the alert is triggered. Up to 100 data records can be returned in response to a set operation on data.

If the value of fire_results exceeds 2 KB in size and the value of a single query result field exceeds 1 KB in size, the value of fire_results is truncated, and the excess part is discarded.

array

See the "Appendix" section at the end of this topic.

The alert is triggered for the following data records: {{ alert.fire_results | to_json }}.

fire_results_count

The total number of data records for which the alert is triggered. The value of this variable may be greater than 100. For example, if you perform a CROSS JOIN operation on data, Simple Log Service may trigger an alert for more than 100 data records.

int

3

The alert is triggered for a total of {{ alert.fire_results_count }} data records.

condition

The trigger condition based on which the alert is triggered. The condition is an expression. Simple Log Service replaces the variables in the trigger condition with the values that trigger the alert. Each value is enclosed in a pair of brackets []. The value of this variable is in the Count:Quantity expression;Condition:Matching expression format.

string

Count:[5] > 3;Condition:[example.com]=='example.com'

The trigger condition based on which the alert is triggered is {{ alert.condition }}.

raw_condition

The original trigger condition. The variables in the trigger condition are not replaced. The value of this variable is in the Count:Quantity expression;Condition:Matching expression format.

string

Count:__count__ > 3;Condition:host=='example.com'

The original trigger condition is {{ alert.raw_condition }}.

policy

The ID of the alert policy or action policy. For more information about the value of this variable, see Policy structure.

map

See the "Appendix" section at the end of this topic.

The ID of the alert policy is {{ alert.policy.alert_policy_id }}.

dashboard

The name of the dashboard that is associated with the alert.

string

mydashboard

The name of the dashboard that is associated with the alert is {{ alert.dashboard }}.

alert_url

The URL of the details page of the alert.

string

https://sls.console.aliyun.com/lognext/project/test-xxxx/alert/alert-1617164106-940166

The URL of the details page of the alert is {{ alert.alert_url }}.

query_url

The URL of the source web page that is accessed for the first query.

string

https://sls.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbn****&queryTimeType=99&startTime=1617175089

The URL of the source web page that is accessed for the first query is {{ alert.query_url }}.

alert_history_dashboard_url

The URL of the Alert History Statistics dashboard.

string

https://sls.console.aliyun.com/lognext/project/test-xx/dashboard/internal-alert-analysis

The URL of the Alert History Statistics dashboard is {{ alert.alert_history_dashboard_url }}.

dashboard_url

The URL of the dashboard that is associated with the alert.

string

https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard

The URL of the dashboard that is associated with the alert is {{ alert.dashboard_url }}.

fingerprint

The fingerprint of the alert. For more information, see Deduplicate alerts based on fingerprints.

string

478325709134bc5c

The fingerprint of the alert is {{ alert.fingerprint }}.

signin_url

The URL of the page on which you can view the details of the alert without the need to log on to the Simple Log Service console. For more information, see View alert details in logon-free mode.

string

https://sls.console.aliyun.com/console/AlertAjax/slsSignIn.json?token=xxxx

[View Details]({{ alert.signin_url }})

Policy structure

The following table describes the variables that can be referenced in the policy variable.

Variable

Description

Type

Value example

alert_policy_id

The ID of the alert policy

string

sls.test-alert

action_policy_id

The ID of the action policy that you configure in the alert rule. This variable is available only when you select Dynamic Action Policy for the alert policy.

string

sls.test-action

repeat_interval

The period during which the action policy is executed only once and Simple Log Service sends only one alert notification if duplicate alerts are triggered. This variable is available only when you select Dynamic Action Policy for the alert policy.

string

4h

QueryData structure

The following table describes the variables that can be referenced in the results variable.

Variable

Description

Type

Value example

store_type

The storage type.

  • log: log data

  • metric: metric data

  • meta: resource data

string

log

region

The region where the destination Logstore or Metricstore resides.

If the value of the store_type variable is meta, this variable is empty.

string

cn-hangzhou

project

The project to which the destination Logstore or Metricstore belongs.

If the value of the store_type variable is meta, this variable is empty.

string

sls-test-alert

store

The name of the destination Logstore or Metricstore.

string

test-logstore

query

The query statement.

string

error | select count(1) as cnt

start_time

The beginning of the time range to query.

If the value of the store_type variable is meta, this variable is empty.

int

1616741485

end_time

The end of the time range to query.

If the value of the store_type variable is meta, this variable is empty.

int

1616745085

raw_results

The data records that are queried. The value of this variable is an array. Up to 100 data records can be returned.

If the value of raw_results exceeds 2 KB in size and the value of a single query result field exceeds 1 KB in size, the value of raw_results is truncated, and the excess part is discarded.

array

[{
    "host": "example.com",
    "slbid": "slb-02",
    "status": "200"
}, {
    "host": "example.com",
    "slbid": "slb-01",
    "status": "200"
}]

raw_results_count

The number of data records that are queried. The number can be greater than 100.

int

20

fire_result

The first data record among the data records for which the alert is triggered. The result set for which the alert is triggered may contain multiple data records. Simple Log Service returns only the first data record of the result set for this variable.

map

{
    "host": "example.com",
    "slbid": "slb-02",
    "status": "200"
}

query_url

The URL of the data records that are queried.

If the value of the store_type variable is meta, this variable is empty.

string

https://sls.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcy*******&queryTimeType=99&startTime=1617175089

dashboard_url

The URL of the dashboard that is associated with the query.

string

https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard

role_arn

The Alibaba Cloud Resource Name (ARN) of the service role that is used.

string

acs:ram::117918634953****:role/aliyunslsalertmonitorrole

FAQ

Appendix

  • results

    [{
        "store_type": "log",
        "region": "cn-hangzhou",
        "project": "sls-alert-test",
        "store": "test",
        "query": "* | select count(1) as cnt",
        "start_time": 1616741485,
        "end_time": 1616745085,
        "dashboard_id": "mydashboard",
        "raw_results": [{
            "cnt": "4"
        }],
        "raw_result_count": 1,
        "fire_result": {
            "cnt": "4"
        },
        "truncated": false,
        "role_arn": ""
    }]
  • fire_results

    [{
        "host": "example.com",
        "host__1": "example.com",
        "pv": "836",
        "slbid": "slb-02",
        "status": "200"
    }, {
        "host": "example.com",
        "host__1": "example.com",
        "pv": "836",
        "slbid": "slb-02",
        "status": "200"
    }]
  • policy

    {
        "alert_policy_id": "sls.test-alert",
        "action_policy_id": "sls.test-action",
        "repeat_interval": "5m0s"
    }